On numerous occasions in 1994, someone on the campus of the University of California at Los Angeles used Wen Ho Lee's password to enter Los Alamos National Laboratory's computer system via the Internet.
Lee's attorneys say it was his daughter, Alberta, playing a computer game. But federal prosecutors, who are continuing to investigate the log-ins, are not so sure. They are trying to determine whether someone else at UCLA may have gained access to the U.S. nuclear secrets that Lee transferred from the classified, highly secure computer network at Los Alamos to a less secure, unclassified network.
Over a period of a year, Lee's password was used about 70 times to log in to the unclassified Los Alamos network from the UCLA campus. Investigators are examining whether it was merely a coincidence that three of those sessions took place within hours after Lee downloaded fresh batches of secrets to the unclassified computer.
Lee, a 60-year-old Taiwanese American physicist, is being held without bail at a federal prison in New Mexico on charges of mishandling classified information, a felony that could bring a life sentence. Prosecutors allege that in addition to putting secret files on the unclassified computer network, he copied the data onto portable tapes, seven of which are missing.
The government, however, has not charged Lee with passing secrets to any foreign country, and one of the major uncertainties of the case is whether Lee's actions harmed U.S. national security.
Lee's daughter, Alberta, who was a mathematics major at UCLA, has testified before a grand jury that she often used her father's password in 1993 and 1994 to get into a supercomputer at Los Alamos to play Dungeons and Dragons, a complicated computer game, according to her father's attorneys.
Investigators have questioned why a college student would need one of the world's most powerful supercomputers to play a game that was at the time accessible on UCLA's computers via the Internet. Lee's attorneys say that she wanted faster access provided by the Los Alamos computer to a Web site in Switzerland that brings together players from around the world. She was also set up to go through a computer at Massachusetts Institute of Technology, they added.
This portion of the government's case is "a red herring," one source close to the family said yesterday, pointing out that after six months of investigation there is still no evidence that any of the classified files were "hacked into" from an outside source.
At Lee's bail hearing in New Mexico last month, prosecutor Paula Burnett called Alberta Lee's explanation an "optional theory," noting that "there is no record of exactly what occurred at that point, so theories may abound."
Cheryl Wampler, a computer expert at Los Alamos, testified that on three days in 1994, just hours after Lee transferred secret files to the lab's unclassified network, someone used Lee's password and personal ID to get into that network via the Internet from various computers at UCLA. Two of the computers were in the university's math department, and the third was in a student activities building, a UCLA spokesman said.
Scott O. Bradner, a professor of computer science at Harvard University, said in an interview that using a supercomputer to play fantasy games might have offered several advantages over UCLA's system.
At the time Lee's daughter said she was using her father's system, college computer resources were often stretched, slowing system responses and making the games frustrating to play, Bradner said. At many schools, game playing was also "relegated to off hours." The Energy Department computer would have been much faster: "It's real hard to slow down a supercomputer."
Besides, he added, "using Daddy's big, bad supercomputer" was also "probably a big status thing."
According to government officials, the FBI has been trying since last June to determine whether anyone other than Lee's children was involved. "These were machines that were collectively used by many different people," Wampler testified.
Scott Larson, the FBI agent who supervised the computer investigation, testified that the Los Alamos computers in 1994 tracked all log-ins, but did not keep any record of what users did once they were inside the system. Without so-called gateway monitoring, he said, there is no record of what, if anything, might have been extracted via the Internet. However, he noted, "Anyone . . . having Dr. Lee's log-in ID and password . . . would be able to access and download" the nuclear material he had placed on the computer.
Larson said that Alberta Lee and her brother, Chung, had their father's password, but that there is no evidence that either of them accessed their father's secret files or gave the password to anyone else.
According to Larson, the security provisions in the Los Alamos computer system in 1993 and 1994 were so poor that "any file out on the unclassified network, whether it be on the supercomputer . . . or on work stations, was potentially vulnerable for capture."
By December 1998, when Lee logged on with his password from a computer in Taiwan, the security system had changed, and the FBI was able to track exactly which files he opened and what he did with them.
Larson testified that because of the repeated sessions over the Internet from UCLA and Taiwan, it is likely that some foreign intelligence agency stole Lee's password. "I have suspicion that his log-in and password has been captured," Larson said. "Whether it's been used or not, I don't know."
During the bail hearing, it also emerged that the FBI found two notebooks in which Lee wrote down his password; step-by-step instructions on how to make a tape on an unclassified workstation at Los Alamos; a list of the classified and unclassified files he had downloaded; and a summary of what was on each of the portable tapes he made.
He kept one of the notebooks at his office and the other at his home. Investigators would like to know why. But Lee so far has not explained many of his actions, including his file transfers and the making of his tapes, which he says he later destroyed.
Staff writer John Schwartz contributed to this report.
CAPTION: Wen Ho Lee's ID was used to access Energy supercomputer from UCLA.